-
Notifications
You must be signed in to change notification settings - Fork 510
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for ECS exec #3075
Merged
Merged
Add support for ECS exec #3075
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| [package] | ||
| name = "amazon-ssm-agent" | ||
| version = "0.1.0" | ||
| edition = "2021" | ||
| publish = false | ||
| build = "build.rs" | ||
|
|
||
| [lib] | ||
| path = "pkg.rs" | ||
|
|
||
| [[package.metadata.build-package.external-files]] | ||
| url = "https://github.com/aws/amazon-ssm-agent/archive/3.2.815.0/amazon-ssm-agent-3.2.815.0.tar.gz" | ||
| sha512 = "724b659f7141dc9c797288f109b35c2a516f08f843d472da0d44f1a04c5fbce30fd8df0cde95be355ca2a710b146c89e1ee3bb5905c297a90b3aaccf78d9da8b" | ||
|
|
||
| [build-dependencies] | ||
| glibc = { path = "../glibc" } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| # Don't generate debug packages because we are compiling without CGO, | ||
| # and the `gc` compiler doesn't append the the ".note.gnu.build-id" section | ||
| # https://fedoraproject.org/wiki/PackagingDrafts/Go#Build_ID | ||
| %global debug_package %{nil} | ||
|
|
||
| %global goproject github.com/aws | ||
| %global gorepo amazon-ssm-agent | ||
| %global goimport %{goproject}/%{gorepo} | ||
|
|
||
| Name: %{_cross_os}amazon-ssm-agent | ||
| Version: 3.2.815.0 | ||
| Release: 1%{?dist} | ||
| Summary: An agent to enable remote management of EC2 instances | ||
| License: Apache-2.0 | ||
| URL: https://github.com/aws/amazon-ssm-agent | ||
| Source0: %{gorepo}-%{version}.tar.gz | ||
| BuildRequires: %{_cross_os}glibc-devel | ||
|
|
||
| %description | ||
| %{summary}. | ||
|
|
||
| %prep | ||
| %setup -n %{gorepo}-%{version} | ||
|
|
||
| %build | ||
| %set_cross_go_flags | ||
|
|
||
| # Set CGO_ENABLED=0 to statically link binaries that will be bind-mounted by the ECS agent | ||
| CGO_ENABLED=0 go build ${GOFLAGS} -installsuffix cgo -a -ldflags "-s" -o amazon-ssm-agent \ | ||
| ./core/agent.go ./core/agent_unix.go ./core/agent_parser.go | ||
| CGO_ENABLED=0 go build ${GOFLAGS} -installsuffix cgo -a -ldflags "-s" -o ssm-agent-worker \ | ||
| ./agent/agent.go ./agent/agent_unix.go ./agent/agent_parser.go | ||
| CGO_ENABLED=0 go build ${GOFLAGS} -installsuffix cgo -a -ldflags "-s" -o ssm-session-worker \ | ||
| ./agent/framework/processor/executer/outofproc/sessionworker/main.go | ||
|
|
||
| %install | ||
| # Install the SSM agent under 'libexecdir', since it is meant to be used by other programs | ||
| install -d %{buildroot}%{_cross_libexecdir}/amazon-ssm-agent/bin/%{version} | ||
| for b in amazon-ssm-agent ssm-agent-worker ssm-session-worker; do | ||
| install -D -p -m 0755 ${b} %{buildroot}%{_cross_libexecdir}/amazon-ssm-agent/bin/%{version} | ||
| done | ||
|
|
||
| %cross_scan_attribution go-vendor vendor | ||
|
|
||
| %files | ||
| %license LICENSE | ||
| %{_cross_attribution_file} | ||
| %{_cross_attribution_vendor_dir} | ||
| %dir %{_cross_libexecdir}/amazon-ssm-agent | ||
| %{_cross_libexecdir}/amazon-ssm-agent |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| use std::process::{exit, Command}; | ||
|
|
||
| fn main() -> Result<(), std::io::Error> { | ||
| let ret = Command::new("buildsys").arg("build-package").status()?; | ||
| if !ret.success() { | ||
| exit(1); | ||
| } | ||
| Ok(()) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| // not used |
67 changes: 67 additions & 0 deletions
67
packages/ecs-agent/0006-execcmd-change-execcmd-directories-for-Bottlerocket.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| From c9f3e2e695fa0c426c7c9196354c5ac7f138845a Mon Sep 17 00:00:00 2001 | ||
| From: Arnaldo Garcia Rincon <[email protected]> | ||
| Date: Wed, 3 May 2023 18:23:40 +0000 | ||
| Subject: [PATCH] execcmd: change execcmd directories for Bottlerocket | ||
|
|
||
| The ECS agent performs checks on directories that, in normal | ||
| circumstances, are mounted on the ECS agent container. Since the ECS | ||
| agent runs as a service in Bottlerocket, the paths to the directories | ||
| are different. | ||
|
|
||
| Signed-off-by: Arnaldo Garcia Rincon <[email protected]> | ||
| --- | ||
| agent/app/agent_capability_unix.go | 2 +- | ||
| agent/engine/execcmd/manager_init_task_linux.go | 4 ++-- | ||
| agent/engine/execcmd/manager_linux.go | 2 +- | ||
| 3 files changed, 4 insertions(+), 4 deletions(-) | ||
|
|
||
| diff --git a/agent/app/agent_capability_unix.go b/agent/app/agent_capability_unix.go | ||
| index 51b4393..76492c7 100644 | ||
| --- a/agent/app/agent_capability_unix.go | ||
| +++ b/agent/app/agent_capability_unix.go | ||
| @@ -37,7 +37,7 @@ const ( | ||
| SSE41 = "sse4_1" | ||
| SSE42 = "sse4_2" | ||
| CpuInfoPath = "/proc/cpuinfo" | ||
| - capabilityDepsRootDir = "/managed-agents" | ||
| + capabilityDepsRootDir = "/usr/libexec/amazon-ecs-agent/managed-agents" | ||
| ) | ||
|
|
||
| var ( | ||
| diff --git a/agent/engine/execcmd/manager_init_task_linux.go b/agent/engine/execcmd/manager_init_task_linux.go | ||
| index 05af158..6117e55 100644 | ||
| --- a/agent/engine/execcmd/manager_init_task_linux.go | ||
| +++ b/agent/engine/execcmd/manager_init_task_linux.go | ||
| @@ -24,7 +24,7 @@ import ( | ||
| ) | ||
|
|
||
| const ( | ||
| - ecsAgentExecDepsDir = "/managed-agents/execute-command" | ||
| + ecsAgentExecDepsDir = "/usr/libexec/amazon-ecs-agent/managed-agents/execute-command" | ||
|
|
||
| // ecsAgentDepsBinDir is the directory where ECS Agent will read versions of SSM agent | ||
| ecsAgentDepsBinDir = ecsAgentExecDepsDir + "/bin" | ||
| @@ -40,7 +40,7 @@ const ( | ||
| ContainerLogDir = "/var/log/amazon/ssm" | ||
| ECSAgentExecLogDir = "/log/exec" | ||
|
|
||
| - HostCertFile = "/var/lib/ecs/deps/execute-command/certs/tls-ca-bundle.pem" | ||
| + HostCertFile = "/usr/libexec/amazon-ecs-agent/managed-agents/execute-command/certs/tls-ca-bundle.pem" | ||
| ContainerCertFileSuffix = "certs/amazon-ssm-agent.crt" | ||
|
|
||
| ContainerConfigFileSuffix = "configuration/" + containerConfigFileName | ||
| diff --git a/agent/engine/execcmd/manager_linux.go b/agent/engine/execcmd/manager_linux.go | ||
| index 706d5da..6322816 100644 | ||
| --- a/agent/engine/execcmd/manager_linux.go | ||
| +++ b/agent/engine/execcmd/manager_linux.go | ||
| @@ -16,6 +16,6 @@ | ||
| package execcmd | ||
|
|
||
| const ( | ||
| - hostExecDepsDir = "/var/lib/ecs/deps/execute-command" | ||
| + hostExecDepsDir = "/usr/libexec/amazon-ecs-agent/managed-agents/execute-command" | ||
| HostBinDir = hostExecDepsDir + "/bin" | ||
| ) | ||
| -- | ||
| 2.39.2 | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,5 @@ | ||
| d /var/lib/ecs/data 0700 root root | ||
| d /var/log/ecs 0755 root root | ||
| d /var/log/ecs/exec 0755 root root - | ||
| R /var/ecs/managed-agents - - - - | ||
| d /var/ecs/managed-agents/execute-command/config 0750 root root - |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You are confident this is another bind mount from the host, and not a CA cert bundle that the agent retrieves from elsewhere and manages?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, this is another bind mount:
ecs-exec on ecs-exec [$] ❯ aws ecs execute-command \ --cluster bottlerocket --task <task-id> --container fedora \ --interactive --command "cat /proc/self/mountinfo" | rg tls 466 439 0:30 /pki/tls/certs/ca-bundle.crt /ecs-execute-command-384f4d6e-39e3-41ee-9e00-609338445345/certs/amazon-ssm-agent.crt ro,noatime - tmpfs tmpfs rw,context=system_u:object_r:etc_t:s0,mode=755The agent does not manage the file. Even in the ECS anywhere script, the host's CA bundle is copied to this location:
https://github.com/aws/amazon-ecs-init/blob/master/scripts/ecs-anywhere-install.sh#L595
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can the patch just point the agent to
/etc/pki/tls/certs/ca-bundle.crtthen? Then we wouldn't need a symlink.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We could do this, however the patch will be bigger since there are other places in the agent that should be updated to reference this file, e.g.
https://github.com/aws/amazon-ecs-agent/blob/master/agent/engine/execcmd/manager_init_task_linux.go#L140